[capableweb]

Use a in-browser PDF renderer, such as mozilla/pdf.js which Firefox uses, and the true and tested browser sandbox will most likely be very helpful.

Obviously, not helpful against three-letter agencies who like to sit on browser zero-days until they need to use them, but against most threats you'll be fine.

[yyyk]

PDF readers are a far more diverse bunch than browsers. It's much less likely someone has a simultaneous break on Adobe Reader/Foxit/okular/evince/xpdf/mupdf/etc. than on merely two browser engines (Chrome and Firefox).